Vulnerability · Published Nov 7, 2022 · Assigned by WPScan
CVE-2022-2711WP All Import < 3.6.9 - Admin+ Directory traversal via file upload
High 7.2
In plain English
A high-severity path traversal in Import any XML or CSV File to WordPress from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.3% (higher than 91% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)4.3%top 8.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Import any XML or CSV File to WordPress | 3.6.9 – before 3.6.9 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H